tensamin/iota
Watch
6
0
Fork
You've already forked iota
 0
Code Issues Pull requests 3 Projects Releases 1 Packages Wiki Activity Actions

Move builds to prod-pins and add explicit update channels
Some checks failed
Validate authentication / Validate authentication (push) Failing after 1s
Details

Browse source
This commit is contained in:
Alois 2026-10-04 19:27:02 +02:00
commit e71d9c3118
Signed by: alois
SSH key fingerprint: SHA256:GBzT2DXvAuGV9XIV5W3WrzVpjU54FThmxHXdbz95J24
15 changed files with 473 additions and 722 deletions
Download patch file Download diff file Expand all files Collapse all files

411
flake.nix
View file

@ -1,389 +1,34 @@
{
description = "Iota";
description = "Iota development and verification";
inputs = {
nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
flake-parts.url = "github:hercules-ci/flake-parts";
rust-overlay = {
url = "github:oxalica/rust-overlay";
inputs.nixpkgs.follows = "nixpkgs";
};
mtp-type-maps = {
url = "git+https://git.methanium.net/tensamin/mtp-type-maps";
flake = false;
};
};
inputs.prod-pins.url = "git+ssh://git@methanium.net/tensamin/prod-pins?ref=main";
outputs =
inputs@{
self,
nixpkgs,
flake-parts,
rust-overlay,
...
}:
flake-parts.lib.mkFlake { inherit inputs; } {
systems = [
"x86_64-linux"
"aarch64-linux"
"x86_64-darwin"
"aarch64-darwin"
];
perSystem =
{
self',
pkgs,
system,
...
}:
let
rustPkgs = import nixpkgs {
inherit system;
overlays = [ (import rust-overlay) ];
};
rustToolchain = rustPkgs.rust-bin.stable.latest.default.override {
extensions = [
"rust-src"
"rust-analyzer"
"clippy"
"rustfmt"
];
};
commonBuildInputs = with pkgs; [
openssl
sqlite
];
commonNativeBuildInputs = with pkgs; [
cmake
perl
pkg-config
];
in
{
packages = {
default = pkgs.rustPlatform.buildRustPackage {
pname = "iota";
version = "0.1.0";
src = ./.;
cargoBuildFlags = [
"-p"
"iota"
"-p"
"iota-daemon"
"-p"
"iota-updater"
"-p"
"iota-installer"
];
cargoLock = {
lockFile = ./Cargo.lock;
allowBuiltinFetchGit = true;
};
nativeBuildInputs = commonNativeBuildInputs;
buildInputs = commonBuildInputs;
dontUseCmakeConfigure = true;
MTP_TYPE_MAPS = "${inputs.mtp-type-maps}/type-maps.yaml";
passthru.dataDir = "/var/lib/iota";
};
iota-daemon = self'.packages.default.overrideAttrs (old: {
pname = "iota-daemon";
cargoBuildFlags = [
"-p"
"iota-daemon"
];
postInstall = ''
for f in $out/bin/*; do
if [ "$(basename "$f")" != "iota-daemon" ]; then
rm "$f"
fi
done
'';
});
iota-ui = self'.packages.default.overrideAttrs (old: {
pname = "iota-ui";
cargoBuildFlags = [
"-p"
"iota"
];
postInstall = ''
for f in $out/bin/*; do
if [ "$(basename "$f")" != "iota" ]; then
rm "$f"
fi
done
if [ -f "$out/bin/iota" ]; then
mv "$out/bin/iota" "$out/bin/iota-ui"
fi
'';
});
};
devShells.default = pkgs.mkShell {
nativeBuildInputs = with pkgs; [
rustToolchain
git
cmake
perl
pkg-config
];
buildInputs = commonBuildInputs;
};
};
flake = {
nixosModules.default =
{
config,
pkgs,
lib,
...
}:
let
cfg = config.services.iota;
defaultPackage =
self.packages.${pkgs.stdenv.hostPlatform.system}.default
or (throw "iota: no pre-built package for system ${pkgs.stdenv.hostPlatform.system}");
configFormat = pkgs.formats.yaml { };
effectiveSettings = lib.recursiveUpdate {
port = cfg.port;
web = {
mode = "network";
bind = cfg.bindAddress;
port = cfg.port;
required = true;
}
// lib.optionalAttrs (cfg.certFile != null) {
certificate = "${cfg.stateDir}/tls/cert.pem";
key = "${cfg.stateDir}/tls/key.pem";
};
} cfg.settings;
sourceConfigFile =
if cfg.settingsFile != null then
cfg.settingsFile
else
configFormat.generate "iota-config.yaml" effectiveSettings;
configFile = "${cfg.stateDir}/config.yaml";
descriptionText = "Tensamin Iota daemon";
in
{
options.services.iota = {
enable = lib.mkEnableOption "Enable the Iota service.";
stateDir = lib.mkOption {
type = lib.types.str;
default = "/var/lib/iota";
description = "Persistent mutable Iota state.";
};
cacheDir = lib.mkOption {
type = lib.types.str;
default = "/var/cache/iota";
};
runtimeDir = lib.mkOption {
type = lib.types.str;
default = "/run/iota";
};
logDir = lib.mkOption {
type = lib.types.str;
default = "/var/log/iota";
};
assetDir = lib.mkOption {
type = lib.types.str;
default = "${cfg.package}/share/iota/web";
};
certFile = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = null;
description = "Path to the SSL certificate file (cert.pem).";
};
keyFile = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = null;
description = "Path to the SSL private key file (cert.key).";
};
environmentFiles = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ ];
description = "Environment files to load for the Iota service.";
};
openFirewall = lib.mkOption {
type = lib.types.bool;
default = true;
description = "Whether to open the firewall for ports used by Iota.";
};
bindAddress = lib.mkOption {
type = lib.types.str;
default = "0.0.0.0";
description = "IP address to bind the HTTP server to.";
};
port = lib.mkOption {
type = lib.types.port;
default = 1984;
description = "TCP and UDP port for protocol-only Iota.";
};
omegaApiUrl = lib.mkOption {
type = lib.types.str;
default = "https://omega.tensamin.net";
description = "Omega discovery API URL.";
};
package = lib.mkOption {
type = lib.types.package;
default = defaultPackage;
description = "The Iota package to use.";
};
settings = lib.mkOption {
type = lib.types.attrs;
default = { };
description = "Configuration attributes for Iota, written to YAML.";
};
settingsFile = lib.mkOption {
type = lib.types.nullOr lib.types.path;
default = null;
description = "Path to an existing YAML file to use instead of generating from settings.";
};
};
config = lib.mkIf cfg.enable {
assertions = [
{
assertion = (cfg.certFile == null) == (cfg.keyFile == null);
message = "services.iota: certFile and keyFile must be set together.";
}
];
users.users.iota = {
isSystemUser = true;
group = "iota";
home = cfg.stateDir;
createHome = true;
description = "Iota service user";
shell = pkgs.bash;
};
users.groups.iota = { };
systemd.sockets.iota = {
description = "${descriptionText} IPC socket";
wantedBy = [ "sockets.target" ];
socketConfig = {
ListenStream = "/run/iota/iota.sock";
SocketMode = "0660";
SocketUser = "iota";
SocketGroup = "iota";
DirectoryMode = "0750";
Backlog = 5;
RemoveOnStop = "true";
};
};
systemd.services.iota = {
description = descriptionText;
wantedBy = [ "multi-user.target" ];
after = [
"network.target"
"iota.socket"
];
requires = [ "iota.socket" ];
environment.OMEGA_API_URL = cfg.omegaApiUrl;
serviceConfig = {
Type = "simple";
User = "iota";
Group = "iota";
ExecStart = "${cfg.package}/bin/iota-daemon";
Restart = "on-failure";
RestartSec = "5s";
RuntimeDirectory = "iota";
RuntimeDirectoryMode = "0750";
RuntimeDirectoryPreserve = "yes";
StateDirectory = "iota";
StateDirectoryMode = "0750";
CacheDirectory = "iota";
CacheDirectoryMode = "0750";
LogsDirectory = "iota";
LogsDirectoryMode = "0750";
# Exit code 75 = restart requested
RestartPreventExitStatus = "0";
RestartForceExitStatus = "75";
TimeoutStopSec = "10";
KillMode = "mixed";
KillSignal = "SIGTERM";
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
ProtectSystem = "strict";
ProtectHome = true;
PrivateTmp = true;
NoNewPrivileges = true;
ReadWritePaths = [
cfg.stateDir
cfg.cacheDir
cfg.runtimeDir
cfg.logDir
];
ReadOnlyPaths = [
cfg.assetDir
];
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectControlGroups = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
Environment = [
"IOTA_SOCKET=/run/iota/iota.sock"
"IOTA_CONFIG_FILE=${configFile}"
"IOTA_STATE_DIR=${cfg.stateDir}"
"IOTA_CACHE_DIR=${cfg.cacheDir}"
"IOTA_RUNTIME_DIR=${cfg.runtimeDir}"
"IOTA_LOG_DIR=${cfg.logDir}"
"IOTA_ASSET_DIR=${cfg.assetDir}"
"IOTA_DEPLOYMENT_MODE=system_socket_activated"
"IOTA_SUPERVISOR=systemd"
];
ExecStartPre = "+${pkgs.writeShellScript "iota-setup" ''
# ponytail: Preserve daemon-assigned IDs; remove config.yaml to reseed changed declarative settings.
if [ ! -e ${configFile} ]; then
install -m 0640 -o iota -g iota ${sourceConfigFile} ${configFile}
fi
${lib.optionalString (cfg.certFile != null) ''
install -d -m 0700 -o iota -g iota ${cfg.stateDir}/tls
install -m 0644 -o iota -g iota ${cfg.certFile} ${cfg.stateDir}/tls/cert.pem
install -m 0600 -o iota -g iota ${cfg.keyFile} ${cfg.stateDir}/tls/key.pem
''}
''}";
}
// lib.optionalAttrs (cfg.environmentFiles != [ ]) {
EnvironmentFile = cfg.environmentFiles;
};
};
networking.firewall = lib.mkIf cfg.openFirewall {
allowedTCPPorts = [ cfg.port ];
allowedUDPPorts = [ cfg.port ];
};
};
};
outputs = { self, prod-pins, ... }:
let
forSystems = prod-pins.inputs.nixpkgs.lib.genAttrs [ "x86_64-linux" "aarch64-linux" ];
project = system: prod-pins.lib.mkPackages {
inherit system;
sources.iota = self;
};
in {
checks = forSystems (system: { inherit ((project system).packages) iota; });
devShells = forSystems (system: {
default = (project system).devShells.iota.overrideAttrs (old: {
TENSAMIN_SOURCE = (project system).packages.iota.transformedSource;
shellHook = (old.shellHook or "") + ''
# Stage authoritative dependencies without changing the checkout.
export TENSAMIN_CHECKOUT="$PWD"
workRoot="/tmp/tensamin-dev-$UID/$(basename "$TENSAMIN_SOURCE")"
if [ ! -d "$workRoot" ]; then
mkdir -p "$(dirname "$workRoot")"
stage="$(mktemp -d "$workRoot.XXXXXX")"
cp -R "$TENSAMIN_SOURCE/." "$stage/" &&
chmod -R u+w "$stage" &&
mv -T "$stage" "$workRoot" || exit 1
fi
cd "$workRoot"
'';
});
});
};
}